CVE-2022-42110

A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
Configurations

Configuration 1 (hide)

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*
cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*

History

No history.

Information

Published : 2022-11-15 00:15

Updated : 2024-02-28 19:29


NVD link : CVE-2022-42110

Mitre link : CVE-2022-42110

CVE.ORG link : CVE-2022-42110


JSON object : View

Products Affected

liferay

  • dxp
  • liferay_portal
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')